httpsig icon indicating copy to clipboard operation
httpsig copied to clipboard

hs2019 with PSS support

Open fulder opened this issue 4 years ago • 1 comments

Try implementing hs2019 support (using PSS).

I've been reading through both these drafts:

  • https://tools.ietf.org/html/draft-cavage-http-signatures-12
  • https://tools.ietf.org/html/draft-ietf-httpbis-message-signatures-00

But still find it a bit confusing on how the digital signature algorithm should be derived from keyId in a good way both at the client and at the server side (funny the same confusion is stated in this appendix B.1.1.1)

Right now I've only added support for PSS algorithm, other algorithms can simply be added by creating new structs in the hs2019.go file. I was thinking that as the client will chose the algorithm and use the correct hs2019 struct, the server can then look up the algorithm in the KeyGetter implementing struct (just like for the key data) and verify the signature using the new GetKeyAlgorithm function (this will be a breaking change for structs implementing this interface today, the whole new draft version feels a bit breaking with the new way of specifying the algorithm).

Hope I haven't misunderstood the new draft version completely, all change requests and help is appreciated.

Related issue: https://github.com/spacemonkeygo/httpsig/issues/7

As all the other algorithms have now become deprecated it would probably be a good idea to remove them entirely. But in order to not introduce even more breaking changes I've kept them and just added a deprecation message to update the algorithm to hs2019 if any other version is used. Guess this will also collide with https://github.com/spacemonkeygo/httpsig/pull/6

The removal can then be done in a second step (after users of this lib get some time to migrate to the new algorithm)

fulder avatar Aug 20 '20 14:08 fulder

+1

McLoone avatar Aug 27 '20 10:08 McLoone